Not rated

CVE-2020-10759 A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware

Description

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

Affected products and versions

Product	Affected versions	Fixed in
fwupd	Versions not published

The 2 CVEs of fwupd →

CVE-2022-3287 When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to… 6.5 Medium

Do you use fwupd?

Track this CVE Watch fwupd Check my SBOMs

www.cveye.io/en/cve/CVE-2020-10759

Timeline

Published September 15, 2020
Last modified August 4, 2024

References

github.com github.com
bugzilla.redhat.com bugzilla.redhat.com

Track this CVE

CVE-2020-10759 A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware

Description

Affected products and versions

Other CVEs of fwupd